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Division: Child Welfare Services 

Vendor: Eokerd Youth Alternative! Inc. 
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Original Contract Amount: $0 

Contract Amount Including this Modification: $0 
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CONTRACTS & PURCHASING 
SIGNATURE ROUTING FORM 


Division: Child Welfare Services 


NF#: 




Vendor: Eckerd Youth Alternative, Inc. 


Original Contract Amount: $0 

Contract Amount including this Modification: $0 

Description: 


Contract Period: 10/01/14-09/30/15 

New Contract ^ _ 

Contract Modification _ 

Competitive Bid _ 

Local Project _ 

MOIK x 


Sole Source 
Intergovernmental 
Rea! Property Lease 
Fixed Rate 
Automatic Renewal 


From: Marvin Smit 
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Signature 


Date 
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Thru: Kim Wilson 

Thru: Tim Harvey 

Thru: Molly Green 

Thru: Jack Ely 
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Cloud, Edward 


From: 

Green, Molly 

Sent: 

Thursday, May 14, 2015 12:12 PM 

To: 

Thorpe, Anita 

Cc: 

Cloud, Edward 

Subject: 

RE: OKDHS MOU ERSF & Data Sharing Agreement 1678 


Approved. Thanks, all! 

Molly Green 

Security & Emergency Mgmt Administrator 
DHS Office of Inspector General 
PH: 405-522-0541 
FX: 405-522-4642 

From: Thorpe, Anita 

Sent: Thursday, May 14, 2015 10:17 AM 

To: Green, Molly 

Cc: Cloud, Edward 

Subject: FW: OKDHS MOU ERSF & Data Sharing Agreement 1678 
Molly, 

1 received Eckerd's MOU with the revisions DHS had requested. 
The BAA language is included. 

It is being routed for signatures, thank you. 

Anita 


Anita Thorpe 

Child Welfare Services 
Contracts and Acquisitions 
Office: (405) 521-3718 
Fax: (405) 522-4666 


From: Thorpe, Anita 

Sent: Thursday, May 14, 2015 10:11 AM 

To: Thoreson, Jace 

Cc: Smith, Marvin 

Subject: FW: OKDHS MOU ERSF & Data Sharing Agreement 
I received Eckerd's revised agreement and it's back with C&P. 


From: Shannon Johnson fmailto:SJohnson2@eckerd.ora1 
Sent: Wednesday, May 13, 2015 3:58 PM 


l 







To: Thorpe, Anita 
Cc: Stacey Welton 

Subject: OKDHS MOU ERSF & Data Sharing Agreement 
Anita 

See attached. As soon as signed on your end, please forward me back via e-mail a fully executed copy. 
Thank you. 

Shannon Johnson 

Director of Contract Management 

TtH&tiMl: namt in jMimd 

Edterd 

100 N. Starcrest Dr. | Clearwater, FL 33765 
P: 727-461-1236 X32SO C: 727-410-2634 
E: SJohnson2@eckerd.ora | URL: www.eckerd.org 


From: Thorpe, Anita 

Sent: Monday, April 06, 2015 4:31 PM 

To: 'Martin Peters' 

Subject: FW: Non-Financial contracts for review 
Martin, 

Here’s another revision: [see attached word document) 

Section 2, Paragraph D, point 1 would read something like: 

"SACWIS. The Agency will allow Eckerd access to the SACWIS system to view client-specific data no less than at least 
once per week." 


From: Thorpe, Anita 

Sent: Monday, April 06, 2015 2:44 PM 

To: 'Martin Peters' 

Cc: Smith, Marvin 

Subject: FW: Non-Financial contracts for review 
Martin, 

The attached data sharing agreement needs to update for Anri! L 2015 and signed . I just now spotted the error 
while search through emails. 

DHS’ Security & Emergency Mgmt Administrator found a couple of typos and wanted the Business Associate 
Agreement (BAA) included; since, it was also in MindShare’s. 


1678/Eckerd 


1. In Section 3.F, there is a typo in the 4 th line. 
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2. Section 3.1, paragraph 2 relates to PHI and includes the line “Eckerd will sign and adhere to an Agency 
Business Associate Agreement (BAA). However, the BAA language is not included in this MOU. 


3. Section 3.M has an error in the final line of the paragraph. The final line says "This Section 3.G shall survive 
termination of this MOU,” That should probably read “..Section 3.M shall survive.. 


A. Business Associate Agreement 

1. BACKGROUND AND PURPOSE: The Parties have entered into, or may in the future 
enter into, one or more written agreements that require Business Associate to be 
provided with, to have access to, and/or to create Protected Health Information (PHI), 
(the ‘"underlying Contract(s)”), subject to the federal regulations issued pursuant to the 
Health Insurance Portability and Accountability Act (HIPAA) and codified at 45 C.F.R., 
parts 160 and 164 (HIPAA Regulations). This BAA shall supplement and/or amend each 
of the Underlying Contract(s) only with respect to the Business Associate’s Use, 
Disclosure, and creation of PHI under the Underlying Contract(s) to allow Covered 
Entity to comply with Sections 164.502(c) and 164.314(a)(2)(i) of the HIPAA 
Regulations. Business Associate acknowledges that it is to comply with the HIPAA 
Security and Privacy regulations pursuant to Subtitle D of the Health Information 
Technology for Economic and Clinical Health Act (HITECH), Title XIII, of the 
American Recovery and Reinvestment Act of 2009, including Sections 164.308, 

164.310,164.312 and 164.316 of title 45 of the Code of Federal Regulations. Except as 
so supplemented and/or amended, the terms of the Underlying Contract(s) shall continue 
unchanged and shall apply with full force and effect to govern the matters addressed in 
the BAA and in each of the Underlying Contract(s). 

2. DEFINITIONS: Unless otherwise defined in this BAA, all capitalized terms used in this 
BAA have the meanings ascribed in the HIPAA Regulations, provided; however, that 
“PHI” and “ePHI” shall mean Protected Health Information and Electronic Protected 
Health Information, respectively, as defined in 45 C.F.R. § 160.103, limited to the 
information Business Associate received from or created or received on behalf of the 
Oklahoma Department of Human Services (DHS) as DHS’ Business Associate. 
“Administrative Safeguards” shall have the same meaning as the term “administrative 
safeguards in 45 C.F.R. § 164.304, with the exception that it shall apply to the 
management of the conduct of Business Associate’s workforce, not DHS’s workforce, in 
relation to the protection of that information. 

3. Business Associate. “Business Associate” shall generally have the same meaning as the 
term “Business Associate” at 45 C.F.R. 160.103, and in reference to the party to this 
agreement, shall mean the entity whose name appears below. 

4. Covered Entity. “Covered Entity” shall generally have the same meaning as the term 
“Covered Entity” at 45 C.F.R. 160.103. 

5. HIPAA Rules. “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, 
and Enforcement Rules at 45 C.F.R. Part 160 and Part 164, all as may be amended. 
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6. The following terms used in this Agreement shall have the same meaning as those terms 
in the HIP A A Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, 
Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, 
Protected Health Information, required By law. Secretary, Security Incident, Sub- 
Contractor, Unsecured PHI, and Use. Obligations of Business Associate: Business 
Associate may use Electronic PHI and PHI (collectively, “PHI”) solely to perform its 
duties and responsibilities under this Agreement and only as provided in this Agreement. 
Business Associate acknowledges and agrees that PHI is confidential and shall not be 
used or disclosed, in whole or in part, except as provided in this Agreement or as 
required by law. Specifically, Business Associate agrees it will: 

a. use or further disclose PHI only as permitted in this Agreement or as Required by 
Law, including, but not limited to the Privacy and Security Rule; 

b. use appropriate safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with 
respect to Electronic PHI, to prevent use or disclosure of PHI other than as provided 
for by this Agreement; 

c. implement and document appropriate administrative, physical, and technical 
safeguards to protect the confidentiality, integrity, and availability of PHI that it 
creates, receives, maintains, or transmits for or on behalf of Covered Entity in 
accordance with 45 C.F.R, 164; 

d. implement and document administrative safeguards to prevent, detect, contain, and 
correct security violations in accordance with 45 C.F.R. 164; 

e. make its policies and procedures required by the Security Rule available to Covered 
Entity solely for purposes of verifying BA’s compliance and the Secretary of the 
Department of Health and Human Services (HHS); 

f. not receive remuneration from a third party in exchange for disclosing PHI received 
from or on behalf of Covered Entity; 

g. in accordance with 45 C.F.R. 164.502(e)(1) and 164.308(b), if applicable, ensure that 
any Sub-Contractors that create, receive, maintain or transmit PHI on behalf of the 
Business Associate agree to the same restrictions, conditions, and requirements that 
apply to the Business Associate with respect to such information; this shall be in the 
form of a written HIPAA Business Associate Contract and a fully executed copy will 
be provided to the Contract Monitor; 

h. report to Covered Entity in writing any use or disclosure of PHI that is not permitted 
under this Agreement as soon as reasonably practicable but in no event later than five 
calendar days from becoming aware of it and mitigate, to the extent practicable and in 
cooperation with Covered Entity, any harmful effects known to it of a use or 
disclosure made in violation of this Agreement; 

i. promptly report to Covered Entity in writing and without unreasonable delay and in 
no case later than five calendar days any Security Incident, as defined in the Security 
Rule, with respect to Electronic PHI; 

j. with the exception of law enforcement delays that satisfy the requirements of 45 
C.F.R. 164.412, notify Covered Entity promptly, in writing and without unreasonable 
delay and in no case later than five calendar days, upon the discovery of a breach of 
Unsecured PHI. Such notice shall include, to the extent possible, the name of each 
individual whose Unsecured PHI has been, or is reasonably believed by Business 
Associate to have been, accessed, acquired, or disclosed during such Breach. 

Business Associate shall also, to the extent possible, furnish Covered Entity with any 
other available information that Covered Entity is required to include in its 
notification to Individuals under 45 C.F.R. § 164.404(c) at the time of Business 
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Associated notification to Covered Entity or promptly thereafter as such information 
becomes available. As used in this Section, “breach” shall have the meaning given 
such term at 45 C.F.R. 164.402; 

k. to the extent allowed by law, indemnify and hold Covered Entity harmless from all 
claims, liabilities, to the extent allowed by law, indemnify and hold Covered Entity 
harmless from all claims, liabilities, costs, and damages arising out of or in any 
manner related to the disclosure by Business Associate of any PHI or to the breach by 
Business Associate of any obligation related to PHI; 

l. provide access to PHI in a Designated Record Set to Covered Entity, or if directed by 
Covered Entity to an Individual in order to meet the requirements of 45 C.F.R. 

164.524. In the event that any Individual request access to PHI directly from Business 
Associate, Business Associate shall forward such request to Covered Entity within 
five working days of receiving a request. This shall be in the form of a written 
HIPAA Business Associate Contract and a fully executed copy will be provided to 
the Contract Monitor. Any denials of access to the PHI requested shall be the 
responsibility of Covered Entity; 

m. make PHI available to Covered Entity for amendment and incorporate any 
amendments to PHI in accordance with 45 C.F.R, 164.526; 

n. document disclosure of PHI and information related to such disclosure as would be 
required for Covered Entity to respond to a request by an Individual for an accounting 
of disclosures of PHI, in accordance with 45 C.F.R. 164.528, and within five working 
days of receiving a request from Covered Entity, make such disclosure documentation 
and information available to Covered Entity. In the event the request for an 
accounting is delivered directly to Business Associate, Business Associate shall 
forward within five working days of receiving a request such request to Covered 
Entity; 

o. make its internal practices, books, and records related to the use and disclosure of PHI 
received from or created or received by Business Associate on behalf of Covered 
Entity available to the Secretary of the Department of HHS, authorized governmental 
officials, and Covered entity for the purpose of determining Business Associate’s 
compliance with the Privacy Rule. Business Associate shall give Covered Entity 
advance written notice of requests from HHS or government officials and provide 
Covered Entity with a copy of all documents made available; and 

p. ensure that all of its Sub-Contractors, vendors, and agents to whom it provides PHI or 
who create, receive, use, disclose, maintain, or have access to Covered Entity’s PHI 
shall agree in writing to requirements, restrictions, and conditions at least as stringent 
as those that apply to Business Associate under this Agreement, including but not 
limited to implementing reasonable and appropriate safeguards to protect PHI, and 
shall ensure that its Sub-Contractors, vendors, and agents agree to indemnify and hold 
harmless Covered Entity for their failure to comply with each of the provisions of this 
Agreement. 

7. Permitted Uses and Disclosures of PHI by Business Associate: Except as otherwise 
provided in this Agreement, Business Associate may use or disclose PHI on behalf of or 
to provide services to Covered Entity for the purposes specified in this Agreement, if 
such use or disclosure of PHI would not violate the Privacy Rule if done by Covered 
Entity. Unless otherwise limited herein. Business Associate may: 

a. use PHI for its proper management and administration or to fulfill any present or 
future legal responsibilities of Business Associate; 

b. disclose PHI for its proper management and administration or to fulfill any present or 
future legal responsibilities of Business Associate, provided that; (i) the disclosures 
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required by law; or (ii) Business Associate obtains reasonable assurances from any 
person to whom the PHI is disclosed that such PHI will be kept confidential and will 
be used or further disclosed only as Required by Law or for the purpose(s) for which 
it was disclosed to the person, and the person commits to notifying Business 
Associate of any instances of which it is aware in which the confidentiality of the PHI 
has been breached; 

c. disclose PHI to report violations of law to appropriate federal and state authorities; or 

d. aggregate the PHI with other data in its possession for purposes of Covered Entity’s 
Health Care Operations; 

e. make uses and disclosures and requests for protected health information consistent 
with Covered Entity’s minimum necessary policies and procedures; 

f. de-identify any and all PHI obtained by Business Associate under this BAA, and use 
such de-identified data, all in accordance with the de-identification requirements of 
the Privacy Rule [45 C.F.R. § (d)(1)]. 

8. Obligations of Covered Entity: 

a. Covered Entity shall notify Business Associate of any changes in, or revocation of, 
the permission by an individual to use or disclose his or her PHI, to the extent that 
such changes may affect Business Associate’s use or disclosure of PHI. 

b. Covered Entity shall notify Business Associate of any restriction on the use or 
disclosure of PHI that Covered Entity has agreed to or is required to abide by under 
45 C.F.R. 164.522, to the extent that such restriction may affect Business Associate’s 
use or disclosure of protected health information. 

c. Covered Entity shall not request Business Associate use or disclose PHI in any 
manner that would violate the Privacy Rule if done by Covered Entity. 

d. DHS agrees to timely notify Business Associate, in writing, of any arrangements 
between DHS and the Individual that is the subject of PHI that may impact in any 
manner the use and/or disclosure of the PHI by Business Associate under this BAA. 


The information and any attachments contained in this message is confidential and intended only for the named recipient’s use. if you have received this message 
from Eckerd in error, you are prohibited from copying, distributing or using the information. Please contact the sender immediately by return email and delete the 
original message. Under Florida law, email addresses are public records. If you do not want your email address released in response to a public records request, 
do not send electronic mail to this entity. Instead, contact this office by phone or in writing, 


The information and any attachments contained in this message is confidential and intended only for the named recipient's use. If you have received this message 
from Eckerd in error, you are prohibited from copying, distributing or using the information. Please contact the sender immediately by return email and delete the 
original message. Under Florida law, email addresses are public records. If you do not want your email address released in response to a public records request, 
do not send electronic mail to this entity. Instead, contact this office by phone or in writing. 


The information and any attachments contained in this message Is confidential and intended only for the named recipient's use. ff you have received this message 
from Eckerd in error, you are prohibited from copying, distributing or using the information. Please contact the sender immediately by return email and delete the 
original message. Under Florida law, email addresses are public records. If you do not want your email address released in response to a public records request, 
do not send electronic mail to this entity. Instead, contact this office by phone or in writing. 


The information and any attachments contained in this message is confidential and intended only for the named recipient’s use. If you have received this message 
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from Eckerd in error, you are prohibited from copying, distributing or using the information. Please contact the sender immediately by return email and delete the 
original message. Under Florida law, email addresses are public records. If you do not want your email address released in response to a public records request, 
(Jo not send electronic mail to this entity. Instead, contact this office by phone or in writing. 
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Search Results 


Current Search Terms: eckerd* Youth* alternative* 


Your search for "Eckerd* Youth* Alternative*" returned the following results... 


Notice: This printed document represents only the first page of your SAM search results. More results may be available. To 
print your complete search results, you can download the PDF and print rt. . 


Entity_| Eckerd Youth Alternatives, Inc. 
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Expiration Date: 09/12/2015 


Status: Active B 


CAGE Code: 3ZYM2 
DODAAC: 
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STATE OF OKLAHOMA 
DEPARTMENT OF HUMAN SERVICES 

WORK PLAN 
Effective date: 10/1/14 


Division: Child Welfare Services 
Eckerd Youth Alternatives, Inc 
100 Starcrest Dr. 

Clearwater, FL 33765 

pa# / 67 ^ 

Marvin Smith has been appointed as program monitor for the above stated contract 
and assumes responsibility for actual monitoring of ail programmatic aspects of the 
contract including the periodic and ongoing review of reports or other valid indications 
of performance. The program monitor also assumes oversight responsibility for fiscal 
monitoring of said contract 

Anita Thorpe has been appointed as fiscal monitor for the above stated contract and 
assumes responsibility for actual monitoring of all fiscal aspects of the contract, 
including ongoing verification of invoices and auditing functions. 


Contract is a memorandum of understanding and will be monitored through review of 
requests for data. C \ / / 

- 9-Z3'/y 



Jami Ledoux, Deputy Director 
Printed name and title of program monitor's supervisor 


OKDHS REVISED 2-15-2004 
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Ecfeefd 


MEMORANDUM OF UNDERSTANDING 

This Memorandum of Understanding ("MOU") is entered into on ApriJ 1, 2015 by and between 
Eckerd Youth Alternatives, Inc. d/b/a Eckerd ("Eckerd"), a Florida not for profit corporation and the 
Oklahoma Department of Human Services ("OKDHS") with respect to our recent discussions 
regarding Eckerd Rapid Safety Feedback*”. Eckerd and OKDHS are sometimes referred to herein 
collectively as the "Parties." 

1. Intent. T his MOU identifies the Parties' understandings of their rights and obligations to 
each other with respect to the implementation of Eckerd Rapid Safety Feedback**'. 

2. Non-Binding Provisions 

A. Definitions 

1. Agency means the Oklahoma Department of Human Services. 

2. Confidential Information means information each party may come into contact 
with concerning the other party, including without limitation client records and 
other proprietary information which must remain confidential pursuant to the 
terms of this MOU. 

3. Bckerd Rapid Safety Feedback " means a program developed by Eckerd that 
utilizes predictive analytics to help identify child welfare cases of the highest 
probability of a serious injury or death and identifying critical case practices, 
that when performed by the Agency to applicable standards, will greatly assist 
in keeping the child safe. 

4. Eckerd Rapid Safety Feedback m Community of Practice means the Agency 
participating in quarterly fidelity reviews and sharing information and reports 
with Eckerd. 

5. Fideiity Reviews means a review by Eckerd to ensure the Agency is 
implementing Eckerd Rapid Safety Feedback** 1 according to established 
practices. 

6. SACWiS means the jurisdiction's statewide automated child welfare information 
system. 


MOU_ERSF_OKDHS_2015 
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7. Portal means a website and related technology that is designed to read SACWIS 
information, perform automated analysis, and generate reports that can be 
used to implement and support Eckerd Rapid Safety Feedback™. 

8. Portal Terms means the website usage terms available on the Portal that sets 
forth the terms and conditions under which the Agency may use the Portal. 

9. QA means Agency Quality Assurance staff member that does not carry a 
caseload. 

B. Introduction 

1. Eckerd is a not for profit corporation that specializes in human services, 
specifically child welfare. During the course of its business, Eckerd has 
developed Eckerd Rapid Safety Feedback*", a program that has been successful 
in reducing the occurrence of serious injury or death in high risk dependency 
cases. 

2. Eckerd, with its affiliates, has developed the Portal and related training 
materials to assist agencies that desire to implement Eckerd Rapid Safety 
Feedback*** 

3. Agency has chosen Eckerd to implement Eckerd Rapid Safety Feedback*" in the 
State of Oklahoma, and this MOU describes the responsibilities of Eckerd and 
the Agency in connection with that implementation. 

C. Eckerd's Responsibilities 

1. Access. Host, maintain and support the Portal with a goal of providing the 
Agency with 24 hour technical support and access to the Portal and the reports 
it generates. 

2. Sample. Adapt the Portal to create reports that provides a customized 
predictive data sample of prioritized cases for review. 

3. Training. Provide training on review completion, portal entry, staffing 
techniques, and action item tracking to support the Agency's implementation of 
Eckerd Rapid Safety Feedback*". 

4. Practice Guide. Provide Agency personnel with access to the Eckerd Rapid Safety 
Feedback*" practice guide for use in connection with the Agency's 
implementation and offer same day technical assistance from case review staff 
experienced in the review process. 

5- Reviews. Perform quarterly fidelity reviews and coordinate sharing of best 
practices across jurisdictions through the Eckerd Rapid Safety Feedback*" 
Community of Practice. 

MOU ERSF OKDHS 2015 
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6. Reports. Provide additional reports as mutually agreed upon by Eckerd and the 
Agency. 

D. Agency's Responsibilities 

1. SACW1S. The Agency will allow Eckerd and Mindshare Consulting Group, i.LC and 
its affiliates access to the SACWIS system to extract client-specific data no less 
than at least once per week. The Agency will allow Eckerd access to the SACWIS 
system to view client-specific data no less than at least once per week." 

2. Peer Reviewers. Provide sufficient reviewers to the Eckerd Rapid Safety 
Feedback*** program. Reviewers should be dedicated QA staff that are NOT 
investigating or managing the case or providing supervision to the front line 
workers assigned to the case. Reviewers must successfully complete Eckerd 
Rapid Safety Feedback* 1 * training (provided at no cost to Eckerd) prior to 
completing case reviews. 

3. Community of Practice. Participate in a quarterly Fidelity Review, sharing 
lessons learned with other jurisdictions, and report the results observed after 
implementation of Eckerd Rapid Safety Feedback***. 

4. Use of Portal. The Agency QA staff member will enter all case reviews into the 
Eckerd Rapid Safety Feedback** portal to provide automated tracking 
functionality, dashboards, and data for the continuous improvement of existing 
predictive data sets for the Eckerd Rapid Safety Feedback*" Community of 
Practice. 

5. Notice. Provide Eckerd written notice of any lawsuit or claim filed or asserted 
against the Agency alleging liability in connection with Eckerd Rapid Safety 
Feedback™ 

3. Binding Provisions 

A. TermofMOU 

1. Term. This MOU will begin at 08:00AM EST on April 1, 2015 and terminate at 
11:59PM EST on March 31, 2016 (the "Term") unless terminated earlier 
pursuant to Section 3A.2. 

2. Termination. Either party may terminate this MOU for any reason with ten (10) 
calendar day written notice to the other party. 

3. Renewal. There are no renewals to this MOU; however, the Parties may 
negotiate a contract to continue Eckerd Rapid Safety Feedback™ as mutually 
agreed upon. 
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B. Compensation 


1. There will be no monetary compensation paid between the parties during the 
Term of this MOU. Consideration for this agreement shall be the mutual 
covenants and promises set forth herein. 

C. Binding Effect. 

1. All provisions under Section 3 of this MOU will create legally binding obligations 
on the Parties (the "Binding Provisions") and will survive any termination of this 
MOU. Except for the Binding Provisions, this MOU will constitute an expression 
of intent only and is not intended to create any legally binding obligation that is 
enforceable against any Party. 

D. Intellectual Property 

1. All SACWIS data will be deemed and treated as Confidential Information of the 
Agency. All intellectual property rights in and to the SACWIS data will remain 
the sole property of the Agency. By making SACWIS data available to Ecfcerd 
and its affiliates, the Agency will grant, and hereby does grant, to Eckerd a 
limited, non-exclusive, royalty-free, fully-paid-up license for the term of this 
MOU to use the SACWIS data, but solely for the purpose of implementing 
Eckerd Rapid Safety Feedback"* for the Agency, providing the Portal and related 
reports, and improving Eckerd Rapid Safety Feedback"". 

2. All intellectual property rights in and to Eckerd Rapid Safety Feedback 3 "", the 
Portal and its related software and documentation, the reports generated by 
the PortaJ, the Eckerd Rapid Safety Feedback"" training materials, the Eckerd 
Rapid Safety Feedback"" safety guide (including without limitation for all of the 
foregoing, all related inventions, processes, improvements, trade secrets, 
algorithms, works of authorship, trademarks and service marks) (jointly the 
"Eckerd IP") is and will remain the sole property of Eckerd, its affiliates, and 
their licensors. All Eckerd IP will be deemed and treated as Confidential 
Information of Eckerd. Eckerd will grant, and hereby does grant, to the Agency 
a limited, non-exclusive, royalty-free, fully-paid-up license for the term of this 
MOU to use the Eckerd IP, but solely for the purpose of implementing Eckerd 
Rapid Safety Feedback*"* for the Agency and subject to this MOU and the Portal 
Terms. 

3. By using the Portal, Agency is agreeing to abide by, and to be bound by, the 
Portal Terms and any applicable laws (including, without limitation laws relating 
to privacy and personal identifying information relating to children). 


E. information Security 

1. Eckerd will perform an annual audit of information security risk assessment 
that is due to the Agency Office of Inspector General Security & Emergency 
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Management Unit by the first day of November of each year for private entities 
and by the last day of January for public entities. The final information security 
risk assessment report shall identify, prioritize and document information 
security vulnerabilities of Eckerd. Eckerd is granted 60 business days after final 
report submission to respond with a mitigation plan for the identified security 
vulnerabilities. Eckerd shall use either the standard security risk assessment 
created by the Office of Management and Enterprise Services or a third-party 
risk assessment meeting of the ISO/IEC 27002 standards and using the National 
Institute of Standards and Technology Special Publication 800-30 {NIST SP800- 
30) process and approved by the Office of Management and Enterprise Services, 

2. Eckerd will disclose any breach of the security system following discovery or 
notification of the breach in the security of the data to any resident of 
Oklahoma whose encrypted or unencrypted personal information was, or is 
reasonably believed to have been, acquired by an unauthorized person. The 
disclosure shall be made in the most expedient time possible and without 
unreasonable delay to Agency Office of the Inspector General & Emergency 
Management Unit. Eckerd must deliver a final report of the breach post¬ 
mortem, citing the reason, sources, affected records, mitigation plans or actions 
within 10 business days of the breach discovery. 


3. Eckerd will comply with the Federal Information Processing Standards - FIPS 
200 that promotes the development, implementation and operations secure 
information systems within governmental agencies by establishing minimum 
levels of due diligence for information security that meet minimum security 
requirements. Eckerd must sign Agency acceptable use, confidentiality and non¬ 
disclosure agreements; user login authorization; and my subject to background 
checks. 


F. User Logon Authorization 

1. Eckerd will not be granted access to the Agency information systems without 
the prior completion and approval of Form 05SC004E. Logon Authorization 
Request for Non-DHS Employees. Certain types of access may require that a 
background check and verification be performed prior to granting access. 
Eckerd will notify the Agency immediately when employees have access to 
Agency systems are terminated. 

G. Background checks and verification 

1. At the sole discretion of the Agency, Eckerd may be subject to user background 
checks, depending on the information systems Eckerd accesses or types of data 
Agency provides. Eckerd must submit the required background check 
information to the agency in a timely manner. The agency will not process any 
access agreements prior to completion of user background verification. 




H. Business continuity and disaster recovery 


1. Eckerd will comply with the Office of Enterprise and Management Services 
minimum mandatory standards for information security and internal controls 
for contingency planning and disaster recovery. Eckerd will develop business 
continuity and disaster recovery plans as stated In the Office of Enterprise and 
Management Service Core Oklahoma Information Security Polity Section 8.0, 
Business Continuity found at 

http://www.ok.eov/OSF/documents/securitvl21Q5.pdf . Contractor is further 
required to exercise, not less than annually, the recovery of capabilities of 
developed plans. Contractor must submit exercise summaries annually or as 
exercises are conducted by DHS Office of Inspector General Security & 
Emergency Management Unit. 

I. Auditing and Compliance 

1. Agency Office of inspector General Security & Emergency Management Unit 
may, at its discretion, audit Eckerd for information security compliance. 
Eckerd must supply corrective action plans for non-com pliant audit findings 
within 30 business days from the receipt of the final audit report from the 
Agency. 

2. Eckerd shall agree to use and disclose Protected Health Information in 
compliance with the Standards for Privacy of Individually Identifiable Health 
Information {"Privacy Rule") Parts 160,162, and 164 of Chapter 45 of the Code 
of Federal Regulations {45 C.F.R. Parts 160, 162 and 164) under the Health 
Insurance Portability and Accountability Act {HIPAA) of 1996 if the data they 
are hosting, storing, accessing, utilizing, managing or manipulating contain 
electronic Protected Health Information (ePHt). The definitions set forth in 
the Privacy Rule are incorporated by reference into this contract {45 C.F.R. 
160.103 and 164.501). Documentation of HIPAA compliance, including but 
not limited to, summaries of policies, procedures, practices and user training 
of this standard must be provided to the Agency, Office of Inspector General 
Security & Emergency Management Unit. Failure to comply with the 
requirements of this standard may result in a full audit and inspection of 
Eckerd's HIPAA security compliance as it pertains to this MOU. Eckerd will 
sign and adhere to an Agency Business Associate Agreement (BAA). The 
Business Associate Agreement provides for satisfactory assurances that Eckerd 
will use the information only for the purposes for which it is engaged. Eckerd 
agrees it will safeguard the information from misuse, and will comply with 
HIPAA as it pertains to the duties stated within the contract. Failure to comply 
with the requirements of this standard may result In a full audit and inspection 
of Eckerd's security compliance as it pertains to this contract. 

J. Business Associate Agreement 

1. BACKGROUND AND PURPOSE: The Parties have entered into, or may in the 
future enter into, one or more written agreements that require Business 
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Associate to be provided with, to have access to, and/or to create Protected 
Health Information (PHI}, (the "underlying Contract(s)"), subject to the federal 
regulations issued pursuant to the Health Insurance Portability and 
Accountability Act (HIPAA) and codified at 45 C.F.R., parts 160 and 164 (HIPAA 
Regulations). This Business Associate Agreement (BAA) shall supplement 
and/or amend each of the Underlying Contract(s) only with respect to the 
Business Associate's Use, Disclosure, and creation of PHI under the Underlying 
Contract(s) to allow Covered Entity to comply with Sections 164.502(c) and 
164.314(a)(2)(i) of the HIPAA Regulations. Business Associate acknowledges 
that it is to comply with the HIPAA Security and Privacy regulations pursuant 
to Subtitle D of the Health Information Technology for Economic and Ctinical 
Health Act (HITECH), Title XIII, of the American Recovery and Reinvestment Act 
of 2009, including Sections 164.308,164.310,164.312 and 164.316 of title 45 
of the Code of Federal Regulations. Except as so supplemented and/or 
amended, the terms of the Underlying Contract(s) shall continue unchanged 
and shall apply with full force and effect to govern the matters addressed in 
the BAA and in each of the Underlying Contract(s). 

2. DEFINITIONS: Unless otherwise defined in this BAA, all capitalized terms used 
in this BAA have the meanings ascribed in the HIPAA Regulations, provided; 
however, that "PHI" and "ePHI" shall mean Protected Health Information and 
Electronic Protected Health Information, respectively, as defined in 45 C.F.R. § 
160.103, limited to the information Business Associate received from or 
created or received on behalf of the Oklahoma Department of Human Services 
(DHS) as DHS' Business Associate. "Administrative Safeguards" shall have the 
same meaning as the term "administrative safeguards in 45 C.F.R. 5 164.304, 
with the exception that it shall apply to the management of the conduct of 
Business Associate's workforce, not DHS's workforce, in relation to the 
protection of that information. Covered Entity is Oklahoma Department of 
Human Services ("OKDHS") and Business Associate is Eckerd Youth 
Alternatives, Inc. d/b/a Eckerd ("Eckerd") 

3. Business Associate. "Business Associate" shall generally have the same meaning 
as the term "Business Associate" at 45 C.F.R. 160.103, and in reference to the 
party to this agreement, shall mean the entity whose name appears below. 

4. Covered Entity. "Covered Entity" shall generally have the same meaning as the 
term "Covered Entity" at45 C.F.R. 160.103. 

5. HIPAA Rules. "HIPAA Rules" shall mean the Privacy, Security, Breach Notification, 
and Enforcement Rules at 45 C.F.R. Part 160 and Part 164, all as may be 
amended. 

6. The following terms used in this Agreement shall have the same meaning as 
those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record 
Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice 
of Privacy Practices, Protected Health Information, required by law. Secretary, 
Security Incident, Sub-Contractor, Unsecured PHI, and Use. Obligations of 
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Business Associate: Business Associate may use Electronic PHI and PHI 
(collectively, "PHI") solely to perform its duties and responsibilities under this 
Agreement and only as provided in this Agreement. Business Associate 
acknowledges and agrees that PHI is confidential and shall not be used or 
disclosed, in whole or in part, except as provided in this Agreement or as 
required by law. Specifically, Business Associate agrees it will: 

a) use or further disclose PHI only as permitted in this Agreement or as Required 
by law, including, but not limited to the Privacy and Security Rule; 

b) use appropriate safeguards, and comply with Subpart C of 45 C.F.R. Part 164 
with respect to Electronic PHi, to prevent use or disclosure of PHI other than as 
provided for by this Agreement; 

c) implement and document appropriate administrative, physical, and technical 
safeguards to protect the confidentiality, integrity, and availability of PHI that it 
creates, receives, maintains, or transmits for or on behalf of Covered Entity in 
accordance with 45 C.F.R. 164; 

d) implement and document administrative safeguards to prevent, detect, 
contain, and correct security violations in accordance with 45 C.F.R. 164; 

e) make its policies and procedures required by the Security Rule available to 
Covered Entity solely for purposes of verifying BA's compliance and the 
Secretary of the Department of Health and Human Services (HHS); 

f) not receive remuneration from a third party in exchange for disclosing PHI 
received from or on behalf of Covered Entity; 

g) in accordance with 45 CF.R. 164.502(e) (1) and 164.308(b), if applicable, ensure 
that any Sub-Contractors that create, receive, maintain or transmit PHI on 
behalf of the Business Associate agree to the same restrictions, conditions, and 
requirements that apply to the Business Associate with respect to such 
information; this shall be in the form of a written HIPAA Business Associate 
Contract and a fully executed copy will be provided to the Contract Monitor; 

h) report to Covered Entity in writing any use or disclosure of PHI that is not 
permitted under this Agreement as soon as reasonably practicable but in no 
event later than five calendar days from becoming aware of it and mitigate, to 
the extent practicable and in cooperation with Covered Entity, any harmful 
effects known to it of a use or disclosure made In violation of this Agreement; 

i) promptly report to Covered Entity in writing and without unreasonable delay 
and in no case later than five calendar days after becoming aware of any 
Security Incident, as defined in the Security Rule, with respect to Electronic PHI; 
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j) with the exception of (aw enforcement delays that satisfy the requirements of 
45 C.F.R. 164.412, notify Covered Entity promptly, in writing and without 
unreasonable delay and in no case later than five calendar days, upon the 
discovery of a breach of Unsecured PHI. Such notice shall include, to the extent 
possible, the name of each individual whose Unsecured PHI has been, or is 
reasonably believed by Business Associate to have been, accessed, acquired, or 
disclosed during such Breach. Business Associate shall also, to the extent 
possible, furnish Covered Entity with any other available information that 
Covered Entity is required to include in its notification to individuals under 45 
C.F.R. § 164.404(c) at the time of Business Associate's notification to Covered 
Entity or promptly thereafter as such information becomes available. As used in 
this Section, "breach" shall have the meaning given such term at 45 C.F.R. 
164.402; 

k) to the extent allowed by law, indemnify and hold Covered Entity harmless from 
all claims, liabilities, to the extent allowed by law, indemnify and hold Covered 
Entity harmless from all claims, liabilities, costs, and damages arising out of or in 
any manner related to the disclosure by Business Associate of any PHI or to the 
breach by Business Associate of any obligation related to PHI; 

l) provide access to PHI in a Designated Record Set to Covered Entity, or if 
directed by Covered Entity to an Individual in order to meet the requirements of 
45 C.F.R. 164.524. In the event that any Individual request access to PHI directly 
from Business Associate, Business Associate shair forward such request to 
Covered Entity within five working days of receiving a request. This shall be in 
the form of a written HIPAA Business Associate Contract and a fully executed 
copy will be provided to the Contract Monitor. Any denials of access to the PHI 
requested shall be the responsibility of Covered Entity; 

m) make PHI available to Covered Entity for amendment and incorporate any 
amendments to PHI In accordance with 45 C.F.R. 164.526; 

n) document disclosure of PHI and information related to such disclosure as would 
be required for Covered Entity to respond to a request by an Individual for an 
accounting of disclosures of PHI, in accordance with 45 C.F.R. 164.528, and 
within five working days of receiving a request from Covered Entity, make such 
disclosure documentation and information available to Covered Entity, in the 
event the request for an accounting is delivered directly to Business Associate, 
Business Associate shaft forward within five working days of receiving a request 
such request to Covered Entity; 

o) make its internal practices, books, and records related to the use and disclosure 
of PHI received from or created or received by Business Associate on behalf of 
Covered Entity available to the Secretary of the Department of HHS, authorized 
governmental officials, and Covered entity for the purpose of determining 
Business Associate's compliance with the Privacy Rule. Business Associate shall 
give Covered Entity advance written notice of requests from HHS or government 
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officials and provide Covered Entity with a copy of all documents made 
available; and 

р) ensure that all of its Sub-Contractors, vendors, and agents to whom it provides 
PHI or who create, receive, use, disclose, maintain, or have access to Covered 
Entity's PHI shall agree in writing to requirements, restrictions, and conditions at 
least as stringent as those that apply to Business Associate under this 
Agreement, including but not limited to implementing reasonabte and 
appropriate safeguards to protect PHI, and shall ensure that its Sub-Contractors, 
vendors, and agents agree to indemnify and hold harmless Covered Entity for 
their failure to comply with each of the provisions of this Agreement. 

7. Permitted Uses and Disclosures of PHI by Business Associate: Except as otherwise 
provided in this Agreement, Business Associate may use or disdose PHI on behalf of or 
to provide services to Covered Entity for the purposes specified in this Agreement, if 
such use or disclosure of PHI would not violate the Privacy Rule if done by Covered 
Entity. Unless otherwise limited herein, Business Associate may: 

a) use PHI for its proper management and administration or to fulfill any present 
or future legal responsibilities of Business Associate; 

b) disdose PHI for its proper management and administration or to fulfill any 
present or future legal responsibilities of Business Associate, provided that; (i) 
the disclosures required by law; or (ii) Business Associate obtains reasonable 
assurances from any person to whom the PHI is disclosed that such PHI will be 
kept confidential and will be used or further disclosed only as Required by Law 
or for the purpose(s) for which it was disclosed to the person, and the person 
commits to notifying Business Associate of any instances of which it is aware in 
which the confidentiality of the PHI has been breached; 

с) disclose PHI to report violations of law to appropriate federal and state 
authorities; or 

d) aggregate the PHI with other data in its possession for purposes of Covered 
Entity's Health Care Operations; 

e) make uses and disclosures and requests for protected health information 
consistent with Covered Entity's minimum necessary policies and procedures; 

f) de-identify any and all PHI obtained by Business Associate under this BAA, and 
use such de-identified data, all in accordance with the de-identification 
requirements of the Privacy Rule [45 C.F.R. § (d)(1)]. 

8, O bligatio ns of Covered Entity: 
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a) Covered Entity shall notify Business Associate of any changes in, or revocation 
of, the permission by an individual to use or disclose his or her PHI, to the extent 
that such changes may affect Business Associate's use or disclosure of PHI. 

b) Covered Entity shall notify Business Associate of any restriction on the use or 
disclosure of PHI that Covered Entity has agreed to or is required to abide by 
under 45 C.F.R. 164.522, to the extent that such restriction may affect Business 
Associate's use or disclosure of protected health information. 

c) Covered Entity shall not request Business Associate use or disclose PHI in any 
manner that would violate the Privacy Rule if done by Covered Entity. 

d) DHS agrees to timely notify Business Associate, in writing, of any arrangements 
between DHS and the Individual that is the subject of PHI that may impact in 
any manner the use and/or disclosure of the PHI by Business Associate under 
this BAA. 


K. HIPAA 

1. Eckerd agrees to use and disclose Protected Health Information in compliance 
with the Standards for Privacy of Individually Identifiable Health Information 
(Privacy Rule) (45 C.F.R. Parts 160 and 164) under the Health Insurance Portability 
and Accountability Act (HIPAA) of 1996. The definitions set forth in the Privacy 
Rule are incorporated by reference into this Contract (45 C.F.R 160.103 and 
164.501). 

L. Governing Law, Venue, and Jurisdiction 

1. This MOU will be governed by and construed in accordance with the laws of the 
State of Oklahoma, excluding any conflicts of laws, rule, or principle that might 
refer the governance or construction of this MOU to the law of another 
jurisdiction. The Parties agree that all disputes, claims, actions, or lawsuits 
between them, arising out of or relating to this MOU, or for alleged breach of this 
MOU, will be heard and determined by a state or federal court sitting in 
Oklahoma, or by any appellate courts which review decisions of those courts. 

M. Entire Agreement 

1. This MOU constitutes the entire agreement of the Parties with respect to the subject 
matter hereof, and supersedes any and all other agreements, understandings, 
negotiations, or representations between the Parties with respect thereto. 

N. Confidentiality 

1. Each Party agrees to maintain in confidence any information disclosed to it by, or 
discovered by it regarding, any other Party or Parties it knows or has reason to know 
is proprietary and/or confidential, including, without limitation, the terms of this 
MOU ("Confidential Information"). If the receiving Party becomes legally required 
to disclose Confidential Information, or any part thereof, the receiving Party shall 
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give the disclosing Party prompt notice of such requirement* If the disclosing Party 
waives compliance with any of the terms of this Agreement or is unable to obtain a 
protective order or other appropriate remedy with respect to such disclosure of 
Confidential Information, then the receiving Party will disclose only that portion of 
the Confidential Information necessary to ensure compliance with such legal 
requirement. This Section 3.N. shall survive termination of this MOU. 


IN WITNESS WHEREOF, the Parties agree to the expressed terms. 


Eekerd 


By:_ 

Name: 

Title: 


OKDHS 



Chief Financial Officer Title: 
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The first name in second chances . 5 " 1 

Ecferd 


DATA SHARING AGREEMENT 

This Data Sharing Agreement ("Agreement") is entered into by and between Oklahoma 
Department of Human Services, (the "Agency"), and Eckerd Youth Alternatives, Inc. d/b/a Eckerd, 
("Eckerd"). 

Whereas, the Agency will make available to Eckerd certain data that is confidential and must be 
afforded special treatment and protection; and, 

Whereas, Eckerd will receive and have access to data from the Agency that can be used or 
disclosed only in accordance with this agreement, the MOU dated April 1,2015, state and federal law; 

Now, therefore, the Agency and Eckerd agree as follows: 

1. Purpose of Agreement . Eckerd represents, and in furnishing the data specified in this 
agreement the Agency relies upon such representation, that the data specified in this 
agreement will be used solely for purposes of Eckerd Rapid Safety Feedback”*. 

2. Description of Data. The Agency may disclose and Eckerd may obtain and use the following 
data ("Data") pursuant to this Agreement: 

a. All data contained in the Statewide Automated Child Welfare Information System 
("SACWIS"). 

3. Point of Contact. The Agency designates the following individual as the Agency's point of 
contact for this Agreement: 

Marvin Smith 
PO Box 25352 
Oklahoma City OK 73125 
405-522-3977 

All correspondence regarding this Agreement, including, but not limited to, notification of 
change of custodianship, uses or disclosures of the data not provided for by this agreement, 
requests for access to the Data, requests for accounting of disclosures of the Data, disposition of 
the Data, and termination of this agreement, will be addressed to the point of contact. 

4. Custodial Responsibility. Eckerd names the following individual custodian of the Data on behalf 
of the Eckerd: 
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Ray Wright, Chief Information Officer 
Eckerd 

100 Starcrest Drive 
Clearwater, FL 33765 
727-461-2990 

The custodian will be responsible for the observance of all conditions of use and for the 
establishment and maintenance of safeguards as specified in this Agreement to prevent 
unauthorized use. 

5. Permissible Uses and Disclosures of Agency Data. Eckerd will not use or further disclose the 
Data specified in this Agreement except as permitted by this Agreement or as required by 
federal law. 

Eckerd will not release or allow the release of the Data specified in this Agreement to any 
persons or entities other than as permitted by Law or by this Agreement. 

Eckerd will restrict disclosure of the Data specified in this Agreement to the minimum number of 
individuals who require the information in order to perform the functions of this Agreement. 

The Agency specifically authorized Eckerd to share the Data with Mindshare Consulting Group 
LLC. 

6. Disclosure to Agents . Eckerd will ensure that any agents of Eckerd, including, but not limited 
to, a contractor or subcontractor, to whom Eckerd provides the Data specified in this Agreement 
agree to the same terms, conditions, and restrictions that apply to Eckerd with respect to the 
Data. 


7. Penalties. Eckerd acknowledges that failure to abide by the terms of this agreement may 
subject Eckerd to penalties for wrongful disclosure of protected health information under 
federal law. Eckerd will inform all persons with authorized access to the data specified in this 
agreement of the penalties for wrongful disclosure of protected health information. 

8. Disposition of Data . Eckerd may retain the Data specified in this Agreement until March 31, 
2016 (the "Retention Date"). Upon the Retention Date, Eckerd will destroy the Data and any 
information derived from its contents, including all copies, modified data, or hybrid or merged 
databases containing the data. 

9. Term of Agreement . This Agreement will be effective upon execution by both parties and will 
remain in effect until March 31,2016. 

The terms of this agreement may not be waived, altered, modified, or amended except by written 

agreement of both parties. 
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IN WITNESS WHEREOF, the Agency and Eckerd have caused this agreement to be signed and delivered 
by their duly authorized representatives as of the date set forth below. 


Eckerd Agency 



Date Title 


SiS-/s- 

Date 
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MAY 28 2015 
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